diff --git a/pulsenode/config/config.yml b/pulsenode/config/config.yml
index faeb163..0a64a80 100644
--- a/pulsenode/config/config.yml
+++ b/pulsenode/config/config.yml
@@ -12,7 +12,7 @@ groups:
 
       - type: traefik
         name: Traefik
-        apiUrl: https://traefik.pivoine.art/api
+        apiUrl: http://traefik:8080/api
         interval: 15s
 
       - type: docker
diff --git a/traefik/compose.yml b/traefik/compose.yml
index b6034a9..dcae35b 100644
--- a/traefik/compose.yml
+++ b/traefik/compose.yml
@@ -21,6 +21,13 @@ services:
       - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
       - "--entrypoints.web.http.redirections.entryPoint.permanent=true"
       - "--entrypoints.web-secure.http.middlewares=security-headers@file,fail2ban@file"
+      # Not published to the host - reachable only container-to-container on
+      # falcon_network. Lets other stacks (e.g. pulsenode) read the API
+      # directly without going through the public hostname, where a hairpin
+      # NAT round-trip through the host's published port rewrites the source
+      # IP and defeats vpn-only's IP allowlist.
+      - "--entrypoints.internal.address=:8080"
+      - "--ping.entrypoint=web-secure"
       - "--certificatesresolvers.resolver.acme.tlschallenge=true"
       - "--certificatesresolvers.resolver.acme.email=${ACME_EMAIL}"
       - "--certificatesresolvers.resolver.acme.storage=/letsencrypt/acme.json"
@@ -53,6 +60,9 @@ services:
       - "traefik.http.routers.traefik-dashboard-web-secure.tls.certresolver=resolver"
       - "traefik.http.routers.traefik-dashboard-web-secure.middlewares=vpn-only@file,security-headers@file,no-index@file"
       - "traefik.http.routers.traefik-dashboard-web-secure.service=api@internal"
+      - "traefik.http.routers.traefik-internal.rule=PathPrefix(`/`)"
+      - "traefik.http.routers.traefik-internal.entrypoints=internal"
+      - "traefik.http.routers.traefik-internal.service=api@internal"
     networks:
       - compose_network
       - coolify_network